90f450cc5ee4180070ea0362a2c072907e5762872df131c550474369134a1fb9

Resubmissions

09/07/2024, 16:08

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 16:08

Target

$PLUGINSDIR/System.dll
Size

29KB
MD5

4c145e9225cb07278f682e4dd3dd8809
SHA1

4cd6f3e73a120fd07944351ab5b94042c5f57009
SHA256

8df989b93d53c74c0551b7e6419ac125ecd950c58afd51c115c8515ad3f3c3ab
SHA512

869c35cd046b20ac74c9e234d07c389f25e93186303ab71048b226af976d00e4f317954ca42a93d3023287042fb17871c108af037b3afe8b3d892f1af074f43e
SSDEEP

384:F5h5h/E6E2XYBVtQQA+S4n+7g6ZxlN7RfYkvIEIwwHMY9pykediAjq:HSPkOVih+S/Fxb7vaHMY8oA+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	2384	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2396 wrote to memory of 2384	2396	rundll32.exe	31
PID 2384 wrote to memory of 1652	2384	rundll32.exe	32
PID 2384 wrote to memory of 1652	2384	rundll32.exe	32
PID 2384 wrote to memory of 1652	2384	rundll32.exe	32
PID 2384 wrote to memory of 1652	2384	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 220
    3⤵
    - Program crash
    PID:1652

memory/2384-0-0x0000000074FE0000-0x0000000074FEF000-memory.dmp

Filesize
60KB

Download